A recently proposed alternative for privacy-preserving training – without data outsourcing – is federated learning (FL) [1]}. FL has emerged as a promising approach to collaboratively train a model by exchanging model parameters with a central aggregator, instead of the actual training data. However, parameter exchange may still leak a significant amount of private data. Several approaches have been proposed to overcome this leakage problem based on differential privacy (DP) [2]}, [3]}, MPC [4]}, [5]}, HE [6]}, [7]}, Trusted Execution Environment [8]}, [9]}, etc. Furthermore, in those settings, the aggregator is a central player, which also potentially represents a single point of failure [10]} and due to the extensive use of cryptographic operations, these frameworks remain too slow for practical use. Finally, other works combine MPC with DP techniques to achieve better privacy guarantees [6]}, [12]}, [13]}. While DP-based learning aims to mitigate inference attacks, it significantly degrades model utility, as training accurate models requires high privacy budgets [14]}. Therefore, a practical distributed privacy-preserving federated learning approach requires strong cryptographic protection of the intermediate model updates during the model aggregation and the final model weights.
